Arch Linux Security Advisory ASA-202102-29 ========================================== Severity: High Date : 2021-02-20 CVE-ID : CVE-2021-20195 Package : keycloak Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1578 Summary ======= The package keycloak before version 12.0.3-1 is vulnerable to cross- site scripting. Resolution ========== Upgrade to 12.0.3-1. # pacman -Syu "keycloak>=12.0.3-1" The problem has been fixed upstream in version 12.0.3. Workaround ========== None. Description =========== A security issue was found in keycloak before version 12.0.3. A self stored cross-site scripting (XSS) attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. Specifically, the Account page does not HTML-encode the user first name, and last name, which means a malicious HTML code, which executes malicious Javascript code, can be embedded into the Account page. Even though the malicious Javascript code is linked to the attacker user (Self-XSS), it can be exploited on the Keycloak admin browser, using the Impersonation functionality, and thus the attacker is able to compromise Keycloak. Impact ====== A malicious user can execute arbitrary code in Keycloak's account page possibly compromising Keycloak's admin account. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1919143 https://issues.redhat.com/browse/KEYCLOAK-16890 https://github.com/keycloak/keycloak/commit/87422b77aee787c6c55ca22fde31c60b... https://security.archlinux.org/CVE-2021-20195